In the Claims: 



Please amend the claims as follows: 

1 . (currently amended) A method to increase a safety integrity level of a single safety 
controller for control of real world objects, the method comprising: 

attaching to the single safety controller a safety-hardware unit wherein the safety- 
hardware unit communicates with a central processing unit of the single safety controller, 

connecting a bus to the single safety controller and connecting an input/output unit to the 

bus, 

downloading safety-related configuration data and/or diagnostic information to the 
attached safety-hardware unit and downloading a control function software to the single safety 
controller, 

configuring the attached safety-hardware unit to execute logic, which depends on the 
downloaded safety-related configuration data and/or diagnostic information, and 

actively or passively setting output values of the single safety controller to a safe state for 
online safety control^ 

obtaining access to a plurality of input and output values of a real world object through 
the bus, and 

verifying a validity of the bus communication with the attached safety hardware unit . 

2. (currently amended) The method according to claim 1, wherein the single safety 
controller has the capability of executing a set of non-safety critical control functions, which set 



2 



of non-safety critical control functions is the same before as well as after the safety hardware unit 
is attached. 

3. (currently amended) The method according to claim 2, wherein the configuring 
comprises: 

downloading to the attached safety hardware unit diagnostic information, which 
previously was automatically generated by a software tool as a result of user's configuration of 
the single safety controller and which diagnostic information is used in the attached safety 
hardware unit during safety critical control. 

4. (cancelled) 

5. (previously amended) The method according to claim 1, wherein the timing 
supervision of the controller is verified in the attached safety hardware unit. 

6. (previously amended) The method according to claim 1, wherein correct sequence of 
code logic is verified in the attached safety hardware unit. 

7. (previously amended) The method according to claim 1, wherein correctness of 
memory content of the controller is verified in the attached safety hardware unit. 

8. (previously amended) The method according to claim 1, wherein a download of new 
control functionality logic to the controller is verified in the attached safety hardware unit. 
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9. (previously amended) The method according to claim 1, wherein the attached safety 
hardware unit performs checks in order to allow only users logged on as safety classified 
engineers and safety classified operators to modify the control functionality logic and 
parameters. 

10. (previously amended) The method according to claim 4, wherein the bus 
communication verification logic in the attached safety hardware unit is implemented diverse. 

11. (previously amended) The method according to claim 4, wherein the attached safety 
hardware unit is diverse generating a safety related header for the bus communication. 

12. (previously amended) The method according to claim 11, wherein the input/output 
unit has two diverse implementations each verifying the correctness of the bus traffic and each 
generating a safety related header for the bus communication. 

13. (previously amended) The method according to claim 1, wherein the attached safety 
hardware unit comprises a first and a second module in a redundant configuration, the second 
module is updated with data that exists first module at the time of a failure and the second 
module takes over the safety related control of the control system from the first module if a 
failure of the first module is detected. 

14. (currently amended) The method according to claim 13, wherein the redundant 
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controller unit is attached to the single safety controller, which takes over in case of a failure of a 
primary controller and the redundant controller unit establish communication with either the 
active first module or the active second module of the attached safety hardware unit. 

15. (currently amended) A single or 1 -channel control system intended for safety-related 
control of real-world objects, comprising: 

a single main central processing unit handling main processes of a single safety 
controller, 

a safety-hardware unit attached to said single safety controller, the safety-hardware unit 
comprising means to increase a safety-integrity level of the single safety controller and 
comprising means to set output values of the single safety controller in a safe state for online 
safety control. 

16. (currently amended) The control system according to claim 15, wherein the single 
safety controller has the capability of executing a set of non-safety critical control functions, 
which set of non- safety critical control functions is the same before as well as after the safety 
hardware unit is attached. 

17. (previously amended) The control system according to claim 16, further comprising: 
means for downloading to the attached safety hardware unit diagnostic information, 

which previously was automatically generated by a software tool as a result of user's 
configuration of the controller and which diagnostic information is used in the attached safety 
hardware unit during safety critical control. 
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18. (previously amended) The control system according to claim 17, further comprising: 
an input/output unit connected to the controller by a bus and the validity of the bus 

communication is verified in the attached safety hardware unit. 

19. (previously amended) The control system according to claim 18, wherein the bus 
communication verification logic in the attached safety hardware unit is implemented diverse. 

20. (previously amended) The control system according to claim 19, wherein the 
attached safety hardware unit is diverse generating a safety related header for the bus 
communication. 
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